lsp-register — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lsp-register (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to register a project for LSP-backed code intelligence. Once registered, all lsp_* query tools become available for that project.
karellen-lsp-mcp must be installed and on PATHclangd — install via pip install --user karellen-lsp-mcp[clangd] or system package managerjdtls — install via pip install --user karellen-lsp-mcp[jdtls]pyright — install via pip install --user karellen-lsp-mcp[pyright]rust-analyzer — install via rustup component add rust-analyzerpip install --user karellen-lsp-mcp[all]lsp_commandQuick scan — count file extensions and see what languages are present:
lsp_scan_languages(project_path="/path/to/project")Full detection — analyze build systems, IDE metadata, and configuration:
lsp_detect_project(project_path="/path/to/project")Both return language recommendations without registering anything. Use scan for a quick overview, detect for build system details and configuration.
#### Auto-Detection (Recommended)
Omit the language parameter to let the server auto-detect:
lsp_register_project(project_path="/path/to/project")Auto-detection scans for build system markers (CMakeLists.txt, build.gradle, pom.xml, pyproject.toml, Cargo.toml, etc.), IDE metadata (.idea/, .classpath, .vscode/), and source file conventions.
#### Explicit Language
Specify the language when auto-detection isn't sufficient:
lsp_register_project(project_path="/path/to/project", language="cpp")#### C/C++ with compile_commands.json
For best results with clangd, provide the compile database location:
lsp_register_project(
project_path="/path/to/project",
language="cpp",
build_info={"compile_commands_dir": "/path/to/build"}
)If not provided, the adapter searches for compile_commands.json in common locations and generates one for CMake/Meson projects automatically. Generated files go to a platform-specific data directory (never pollutes the project tree).
Generating compile_commands.json manually:
cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -B buildmeson setup build (generates automatically)bear -- make#### Java/Kotlin with jdtls
jdtls handles both Java and Kotlin via karellen-jdtls-kotlin:
lsp_register_project(project_path="/path/to/project", language="java")For multi-module Gradle projects, register the root (where settings.gradle is):
lsp_register_project(project_path="/path/to/gradle-root", language="java")#### Python with pyright
lsp_register_project(project_path="/path/to/project", language="python")Virtual environments are detected automatically. To specify one explicitly:
lsp_register_project(
project_path="/path/to/project",
language="python",
build_info={"venv_path": "/path/to/.venv"}
)#### Rust with rust-analyzer
Register at the directory containing Cargo.toml:
lsp_register_project(project_path="/path/to/crate", language="rust")For Cargo workspaces, register at any member crate — the workspace root is detected automatically. Do NOT register at a parent directory that has no Cargo.toml.
#### Custom LSP Server
For languages without a built-in adapter:
lsp_register_project(
project_path="/path/to/project",
language="go",
lsp_command=["gopls"]
)Single-file queries (definition, hover, symbols) work immediately. Cross-file queries (references, call hierarchy, diagnostics) wait for indexing automatically with progress-driven timeout extension.
Check indexing progress on large codebases:
lsp_indexing_status(project_id="<id>")All queries use the project_id returned by registration:
lsp_read_definition — go to definitionlsp_read_declaration — go to declaration (header/interface)lsp_read_type_definition — go to the type definition of a variablelsp_find_references — find all referenceslsp_find_implementations — find all implementations of interface/abstractlsp_hover — type signature and documentationlsp_document_symbols — list symbols in a filelsp_workspace_symbols — search symbols across the project by namelsp_call_tree_incoming / lsp_call_tree_outgoing — recursive call trees (preferred)lsp_call_hierarchy_incoming / lsp_call_hierarchy_outgoing — single-level call chainslsp_type_tree_supertypes / lsp_type_tree_subtypes — recursive type trees (preferred)lsp_type_hierarchy_supertypes / lsp_type_hierarchy_subtypes — single-level type infolsp_diagnostics — compiler errors and warningslsp_deregister_project(registration_id="<registration_id>")This decrements the refcount using the unique registration_id returned by lsp_register_project. Each token can only be used once. The LSP server stops when all registrations are released.
cmake, make, meson, cargo build, gradle,mvn, pip install, etc.) on the user's project. The LSP adapter handles build configuration automatically. If compile_commands.json is missing for C/C++, register the project anyway — clangd still works without it, and the adapter generates one for CMake/Meson in a managed directory without polluting the project tree.
monorepos or polyglot projects, use lsp_detect_project first to find the correct root for each language (where Cargo.toml, pyproject.toml, CMakeLists.txt, etc. lives). Registering at a parent directory that lacks the language's build system marker will fail or produce no results.
LSP server instance (refcounted).
with force=True to kill and restart it.
(compilation databases, workspace caches) and force-restarts the LSP server. Equivalent to lsp_regenerate_index but available directly on lsp_register_project.
default readiness timeout. Defaults: 30s for lifecycle tools, 120s for query tools.
indexing field in results;if true, results may be incomplete.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.